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DISCLOSURE TEXT: 

In a banking system using an Automatic Teller Machine 
(ATM) 

which is also known as a Personal Banking Terminal, 
means is provided 

for an authorized individual secretly to inform the 
system that he is 

under duress; that is, his session is not under his 
control but that 

of another individual. When thus alerted that a 
customer's session 

is not legitimate (from the individual's point of 
view) , previously 

defined system actions can be taken. 

Electronic systems which require a user to 
identify himself and 

establish his authority to execute ■ certain transactions 
are becoming 

common. There are, within many business 
establishments, systems . 

which provide for electronic mail, payroll processing, 
accounts 

receivable processing and program development in 
addition to other 

applications far too numerous to mention. The use of 
personal 

computers in the home to access extensive 
communications networks is 
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increasing- Automatic Teller Machine (ATMs) are 
virtually everywhere 

and their capabilities are expanding. There are ATMs 
attached to 

banking networks that permit the withdrawal of cash and 
the transfer 

of funds from one account to another to name two common 
place 

applications . 

This trend extends even to the telephone system where 
long distance telephone calls are made without operator, 
intervention 

based on the possession of a 'phone card' that 
authorizes the call. 

In order to provide for transaction security 

and definite 

customer identification, many of these systems require 
the user or 

customer to provide a magnetically coded card and a 
personal 

identification number (PIN) . If the correct PIN is 
provided to the 

system, the transaction is completed. If an incorrect 
PIN is 

entered, the transaction is aborted. In some systems, 
if the PIN is 

incorrectly entered a number of times, the customer's 
card is 

confiscated. 

None of these systems provide any way for a 
legitimate user who 

is under the physical control of an unauthorized 
individual to take 

any action to protect himself by calling for help 
without the 

knowledge of the unauthorized person. While instances 
of such 

situations do not seem to be wide-spread today, they 
may become more 

frequent as more systems are placed in use and more 
opportunities for 

such criminal behavior are created. 

This article describes a means for a legitimate 

user to 

secretly inform a system that his actions are not 
freely taken. Once 

alerted, the system can respond in any of a number of 
predetermined 
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ways ranging from 'record the alert only, take no 
action' to 

'dispatch appropriate authorities to this location.' A 
system with 

this capability provides a deterrent to criminal 
behavior, a sense of 

safety to its legitimate users and a means of system 
self protection 

in the event of a coerced, unauthorized access. 

There are seven constraints that a method to 

provide this 

silent alarm should meet. First, it should be possible 
for the 

authorized individual to alert the system without the 
knowledge of 

the unauthorized person. Second, since the authorized 
user may well 

be in a state of high emotion, the method should be 
simple to 

remember and use; this suggests it should be as similar 
to normal 

behavior as possible. Third, the alert mechanism must 
be under the 

control of the authorized user so that no alert is 
issued if the user 

feels that doing so would jeopardize him. (A person's 
willingness to 

resist a criminal action is often determined by the 
degree of 

perceived consequent loss to him. 
One who has only $5.00 in his 

wallet is perhaps more likely to submit to a mugger 
than one who has 

$500.00 on his person, although there is wide variation 
in individual 

behavior.) Fourth, it should not require extensive 
hardware , software 

or internal licensed programming to implement (to keep 

the 

development and maintenance costs low) . Fifth, it 
should not place 

any unusual or difficult constraints on existing 
systems or their 

operations. For example, a system that did not require 
a re-issuance 

of ATM access cards would be preferred over one that 
required all 

users to receive a new access card. Sixth, the 
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implementation should 

not preclude, by its presence, any additional features 
that might be 

desirable. Seventh, it should be possible to define a 
range of 

' actions to be taken in the event of an alert being 
raised. 

In light of the above, the present invention 
provides a means 

for a legitimate user to secretly inform a system that 
his actions 

are not freely taken. Once alerted, the system can 
respond in any of 

a number of predetermined ways ranging from ' record the 
alert only, 

take no action' to * dispatch appropriate authorities to 

this 

location, » A system with this capability provides a 
deterrent to 

criminal behavior, a sense of safety to its legitimate 
users and 

means of system self protection in the event of a 
coerced, 

unauthorized access. 

The coercion detection scheme consists of 
altering the existing 

access code verification mechanism (e.g., verification 
of PINs or 

passwords) to allow recognition of the legitimate 
access code when 

the code has been entered in reverse order and, 
further, to recognize 

this as an 'alert'. The verification mechanism should 
then take the 

appropriate action, as previously defined for this 
system and user, 

to respond to the alert . 

For example, suppose the user's ATM PIN was 

' 1435 ' . To 

indicate that he was acting under duress, the user * 
would enter his 

PIN as '5341' rather than '1435.' This inverted or 
reversed PIN 

would normally be rejected but with the addition to the 
ATM PIN 

verification mechanism of coercion 'detection the '5341' 
would be 

recognized as a valid alert PIN and the ATM system 
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would take the 

previously defined alert action. 

There are, of course, alternative algorithms 
that could be 

used. For example, the ALERT PIN could be the user's 
PIN with the 

addition (subtraction) of a constant. To the PIN used 
above, ' 1435 ' 

add the constant '1111' to make the ALERT PIN '2546.' 
For another 

alternative, simply add a constant of '5' so the ALERT 
PIN would 

become '1440.' It's evident that the particular 
algorithm, provided 

that it meets the seven constraints, is not important. 

It • s 

desirable, from a cost and simplicity perspective that 
the algorithm 

be the same for all customers, but it's certainly 
possible to make a 

set of different algorithms available. Such an 
approach, which is 

slightly more costly and difficult to implement (and 
slightly 

increases the likelihood of a random attack succeeding) 
has the 

advantage of providing additional protection for the 
user of the 

ALERT PIN. 

That is, if only one algorithm is available for an 

ALERT 

PIN, then it can be assumed that everyone knows that 
(and hence an 

unauthorized person might be tempted to force a 
legitimate user to 

provide the PIN, undo the (supposed) algorithm and then 
attempt to 

use it. Were there two or more alternative ALERT PIN 
algorithms, it 

would be more difficult to succeed with this (and there 
would be 

higher degree of deterrence) . 

For the sake of simplicity, consider that there 

is only one 

algorithm for creating the ALERT PIN from a valid one. 
The algorithm 

is entry of the PIN in reverse order. Note that this 
algorithm 
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provides the seven advantages described above. 

1. A PIN of '5341' is no more or less likely than a 
PIN of ' 1435 ' 

hence an unauthorized person has no way to know if 
the alert has 

been given or not . 

2. Entering the PIN (or password) in reverse order is 
easy to 

remetnber and do. 

3. By permitting the user the choice of either '1435' 
or '5341' the 

decision to raise the alarm resides with the user. 

4. Reversing the characters and attempting a 
reverif ication does not 

require any additional hardware (although it could 
be implemented 

'fully or partially as such) and can be implemented 
using a small . 

amount of either software or microcode. 
A coercion response 

action table would also require some internal 
storage and code or 

hardware (see 7, below) . 

5. This scheme does place a small constraint on 
existing systems; 

all PINs or passwords that were 'palindromic' (that 
is, they read 

the same backwards as forward) would have to be 
re-issued as 

non-palindromes, and any PIN or password checking 
programs would 

have to be changed to reject a user- selected 
palindromic PIN or 

password. For example, a PIN of '1331' could not 
be used. The 

rejection of palindromic PINs and passwords also 
increases 

slightly the likelihood of a random guess being 
correct; this is 

exactly offset, however, by the likelihood that the 
random guess 

raises the alarm] 

6. Additional features will not be precluded by this 
scheme . 

7. 

Once the alert has been set within the program or 
hardware , by 

reference to an internally stored table or data 
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magnetically 

stored on an ATM access card, for example, the 
action defined for 

this user could be taken. (Note that a null table 
entry for a 

user could easily be defined to mean that this user 
has declined 

the use of the coercion detection mechanism; in 
such a case, the 

system would behave exactly as though the valid PIN 

had been 

entered-) 

An additional advantage of the coercion detection 
mechanism is 

this: an unauthorized user can take the access card 
(or password) or 

be given it by the legitimate user along with the ALERT 
PIN (the 

reverse, that is, of the correct PIN or password) . 
Then, every time 

the card is used, the unauthorized user transmits his 
location to the 

system. This can only make apprehension easier. 
Since it can be 

expected that potential unauthorized users will know 
about the ALERT 

PIN, it might be expected that they would reverse the 
PIN that a 

legitimate user provided. This presents an interesting 
scenario: if 

the unauthorized user suspects that he has been given 
the ALERT PIN 

and reverses it (in the hope of then passing himself 
off as the 

legitimate user) when in fact, he was given the- valid 
PIN, he will 

then be contributing to his own apprehension. On the 
other hand, if 

he assumes that he has the valid (the non-reversed PIN) 
when he 

actually has the ALERT PIN, he is once again 
contributing to his 

apprehension. The point is that the unauthorized user 
has no way of 

knowing since the system may present identical 
operation for both the 

PIN and the ALERT PIN. 

This ALERT PIN provides a simple solution to a 
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potentially very- 
serious situation, that of legitimate users who are 
forced to 

participate in the subversion of a system that they* re 
authorized to 

access. While the description given in this article 
has focused on 

PINs and ATMs, the approach is far more general and can 
be adapted to 

a wide variety of situations easily and effectively. 
The legitimate 

users are provided with a safe way to alert the system 
to their 

situation and may be provided with an option to define 
the action 

they wish taken in the event of coercion. Example 
actions are: 

o Limit the allowed dollar amount of transactions 
o Limit authority to selected transaction types 
o Display "dummy" account information 
o "Close" an ATM 

o Notify authorities (silent alarm) 

o Dispatch security personnel or police 

SECURITY: Use, copying and distribution of this data is 
subject to the 

restictions in the Agreement For IBM TDB Database and 
Related Computer 

Databases . Unpublished - all rights reserved under the 
Copyright Laws of the 

United States. Contains confidential commercial information 
of IBM exempt 

from FOIA disclosure per 5 U.S.C. 552(b) (4) and protected 

under the Trade 

Secrets Act, 18 U.S.C. 1905. 

COPYRIGHT STATEMENT: The text of this article is 
Copyrighted (c) IBM 

Corporation 1993. All rights reserved. 
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ABSTRACT 



An automatic teller system and a method of operating 
same wherein the system can receive a personalized 
normal PIN number and emergency PIN number from 
a user. If the user enters the emergency PIN number, 
the system determines that it is an emergency PIN num- 
ber and actuates a silent alarm. The system will also 
simulate a normal transaction so as to not alert a thief or 
potential thief that the alarm has been actuated. 

5 Claims, 2 Drawing Sheets 
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* , . ■ ATM. Video and audio information can be 

AUTOMATIC TELLER SYSTEM AND METHOD transmitted via modem to bank security people or the 
OF OPERATING SAME poUce at the same time. 

BACKGROUND OF THP rMVPNTTTOM c ^ ^ assigned a personalized emergency PIN 

BACKGROUND OF THE INVENTION. 5 number similar to the standard PIN number, instead of 

The present invention relates to an automatic teller a common one for all users. It is impossible for a thief to 

system and a method of operating same. know that an emergency PIN number has been entered 

Cwent automatic teller systems allow a user to with- . since the numbers would not be easily identified, i.e., 

draw cash from an automatic teller machine (ATM) by one user may have an emergency PIN number which is 

first inputting a credit card into a card reader and there- the same as another user's standard PIN number 

after entering a personal identification number (PIN In a preferred embodiment of the present invention, 

numbo-) on a keypad. The system determines that the the method also includes simulating a normal transac- 

luer IS authorized to m^e a withdrawal on the basis of tion in response to the determination that an emergency 

the correctness of the Pm number, and thereafter de- pin number has been entered. The simulated trLac- 

J^T^J^T'^l^' Aat parucuiar credit card. ^5 ^ ^ 

^^^^rTt^^^^^ "^^^^^ potentialthiefthatauthoritieshavebeennotified.Inthe 

the amount of cash to be withdrawn, and the user enters cJmi.iat«H ««t^oi tr^^c.^^^^ tu^.. * ^ r 

the cash amount on the keypad. The request is pro- T ^ojm3\U2j^non the user is prompted for 

cesseduptothecreditlimit^dcashisdisJensedtoV the~ofca^ tobe wi± 

user ^ 20 a normal transaction, and the user IS thereafter asked to 

In' recent years, it has become common for thieves to ^ "t^^ ^^"^^ °" ^^^P^ ^"^^ ^ 

pray on automatic teUer machine users, by either ac- transaction However, this system will automatically 

costing the user after completing a transaction or by "^^icate that the credit limit is less than the amount 

inducing the user under the threat of force to make a requested so that only a Umited amount of cash will be 

withdrawal fit)m the user's account. 25 dispensed. This will reduce the amount of the theft 

The current systems such as those shown in U.S. Pat appearing to be a normal transaction and not 

Nos. 4,359,63(>, 5,029,290; 5,103.079; 5,095,196; alerting the thief to the fact that an alarm has been 

4,801,787; 4,798,941; 4,650,980; and 4,304.990 have no actuated. 

way in which to enable the user to signal that either Moreover, the cash dispenser can dispense marked 

there is a fear of being accosted upon finishing the trans- 30 bills from a special supply of bills, so that the bills that 

action or that the transaction is being entered into under are dispensed can be identified later, 

duress. These and other features and advantages of the pres- 

^ ^'.^* f ^'3^5»032 a transaction processing ent invention are also achieved in accordance with an 

system is disclosed wherein when card is reported lost automatic teller system according to the present inven- 

or stolen by a user, its subsequent tmauthorized use 35 tion comprising means receptive of a personal PIN 

triggers a mode wherein the transaction is delayed to number and a unique or personalized emergency PIN 

detam the unlawful user. No use is made of a PIN num- number input by a user, means for determining tiiat an 

T« TTc Ki^ A^-r<ci« * • ^ -V. entered PIN number is an emergency PIN number and 

In U.S. Pat No. 4,675,815 a systan is descnbed means responsive to that determination for actuating an 

wherem a b^ employee at a remote location who is 40 ^^rm, pix^ferably a silent alarm. The automatic tdler 

credidng unds to an account can ent^ a predetermined ^y^^em according to tiie present invention also prefera- 

""-^.l^^^l" "^V ^^J^ w[y includes me^s for sSiulating a normal tra^action 

transfer. This system does not utilize a PIN number for • ^ ^ ^ . ^. 

each transaction and uses a single code for TZZs Z ^^^^^ to the detenmnati^^^ 
signal a problem. u users lo ^^^^^ ^ ^ ^^^^^^ mcludmg means for dispens- 

ing a predetermined limited amount of cash to the user. 

SUMMARY OF THE INVENTION These and other features of the present invention will 

The main object of tiie present invention is to elimi- l'^ described in the following detailed description of tiie 
nate the disadvantages of tiie present systems and to "^^ention taken witii the attached drawings, wherein: 
provide an automatic teller system and a method of 50 BRIEF DESCRIPTION OF THE DRAWINGS 
operating same to enable a user to actuate an alarm 

without alerting a thief or potential thief. I is a, block diagram of the automatic teller 

These and otiier objects and advantages of tiie pres- system in accordance with the present invention; and 
ent invention are achieved in accordance with the pres- ? ^ ^ ®^ ^he method according to the 

ent invention by a method of operating an automatic 55 Present invention. 

teller system wherem Uie user is assigned a unique or DETAILED DESCRIPTION OF THE 

personahzed emergency PIN number in addition to the INVENTION 
normal, unique PIN number. The system then checks 

the entered PIN number to determine whether it is an Referring now to FIG. 1, the automatic teller system 
emergency PIN number for that user or not and, if an 60 according to the present invention includes an auto- 
emergency PIN number has been entered, actuating an matic teller machine (ATM) 5 which includes a mag- 
alarm, preferably a silent alarm. Moreover, the method '^etic stripe card reader 1, a user keypad 2, a display 3 
includes enabling cameras set up at the automatic teller and a cash dispenser 4. The system also includes a cen- 
system to record the transaction either in an enhanced tral computer 10 which receives the information read 
manner or with more cameras so that the identity of the 65 from the credit card reader 1 and personal identification 
thief can be more reliably obtained for later apprehen- numbers entered on keypad 2 and prompts the user via 
sion and conviction. The silent alarm will enable bank display 3 and actuates cash dispenser 4 to dispense cash 
security people or the police to be dispatched immedi- to the user. 
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The keypad 2 is used by a user to enter a personal avoid alerting the thief or potential thief that an alarm 

identification number in the form of either a nonnal has been actuated. In this matter, the central computer 

PIN number or an emergency PIN number which has 10 controls the display 3 to prompt the user for a cash 

been assigned to the user by the bank. The central com- amount in step 112. The user then enters the desired 

puter 10 receives the PIN number from the keypad 2 5 amount of ca^h on keypad 2 in step 113. Rather then 

and is able to determine, based upon lists of PIN num- treating this transaction wherein the user is permitted to 

bers for each account indicated by the card reader 1, withdraw an amount up to the user's actual credit limit, 

whether the PIN number is a normal PIN number or an the central computer controls display 3 to indicate that 

emergency PIN number. The central computer 10, the credit limit is less than the amount requested in step 

upon determining that the PIN number is an emergency 10 114 so as to artificially limit the amount of the transac- 

PIN nimiber, controls a silent alarm 7 which , immedi- tion to reduce the amount of theft. The central com- 

ately notifies the authorities that a theft is taking place at puter then authorizes this Umited withdrawal in step 117 

the ATM 5. The central computer 10 also actuates and actuates cash dispenser 4 m step 108 to dispense this 

camera 6 either by enabling additional views of the limited amount of cash. The system then returns to the 

scene or by enhancing the view of the scene such as by 15 ready state in step A. 

taking a close up of the scene. It is understood that the present invention is not lim- 
The method of operating the automatic teller system ited to the particular embodiments illustrated and de- 
is set forth in FIG. 2. As shown therein, at the starting scribed hereinabove, but that various changes and mod- 
point A the iiser inputs a magnetic stripe credit card into ifications may be made without departing from the 
a card reader, and the card reader reads the card in step 20 spirit and scope of the invention as defined in the claims. 
100. The information is sent to the central computer 10 What is claimed is: 

which then prompts the user on display 3 for entry of 1. In a method of operating an automatic teller system 

the PIN number in step 101. The user inputs the PIN wherem a card is input by a user, the card is read, a 

number in step 102 via keypad 2. This information is personalized nonnal first PIN number selected by the 

sent to the central computer 10 which, in step 103, 25 user is entered by the user and is checked to determine 

determines whether it is a personal PIN number or not whether the use of the card is authorized, if authorized 

If the PIN number is the normal personal PIN number, a credit limit is determined and a desired amount of cash 

the computer then determines the credit limit , in step not exceeding the credit limit is dispensed to the user, 

104 and prompts the user on display 3 in step 105 for the the improvement comprising the steps of: providing a 

amount of cash desired for withdrawal. The user then 30 personalized emergency second PIN number to each 

enters the amount of cash desired in step 106 on keypad user selected by the user in addition to the personalized 

2 and the central computer 10 receives this information normal first PIN number checking the entered PIN 

and processes this request in step 107 up to the credit number of each user to determine whether it is the 

limit. Thereafter, the central computer 10 in step 108 normal first or emergency second PIN number of that 

actuates the cash dispenser to dispense cash. The system 35 user; and actuating an alarm in response to the determi- 

then returns to the ready state of step A. nation of an entered emergency second PIN number for 

If on the other hand, the central computer 10 deter- that, user, while dispensing a limited amo\mt of cash to 

mines in step 103 that the PIN number is not the normal that user. 

personal PIN number, the central computer then makes 2. The method according to claim 1, further compris- 

a determination in step 110 if it is an emergency PIN 40 ing simulating a normal transaction upon the determina- 

number. If it is not an emergency PIN number, the tion of an entered emergency second PIN number by 

determination is made in step 111 that it is just the prompting the user to enter a desired amount of cash, 

wrong PIN number and the user is again prompted in displaying a message that the desired amount exceeds 

step 101 to enter a PIN number on the keypad 2. the user's credit limit and dispensing a preselected lim- 

If the central computer 10 determines in step 110 that 45 ited amount of cash, 

it is an emergency PIN number assigned to that user, the 3. The method according to claim 1, wherein the step 

central computer then acts to perform two functions: of actuating an alarm comprises actuating a silent alarm. 

The first function in steps 115 and 116 is to actuate a 4. The method according to claim 1, fiirther compris- 

silent alarm and notify security in step 115 of a theft or ing enabling cameras at the automatic teller system in 

a potential theft taking place. In step 116, the central 50 response to a determination of an entered emergency 

computer actuates a camera 6 to either start filming the second PIN number. 

scene or to enhance the filming by obtaining a close up 5. The method according to claim 1, wherein the step 

of the scene. of dispensing a limited amount of cash comprises dis- 

The other function carried out by the central com- pensing marked bills, 

puter 10 is to simulate a normal transaction soastoSS *♦♦♦» 
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